Issues

• Bring Relay CI and test quality up to the cic-primitive-forms level

  CentralInfraCore/CIC_Relay#169 · Filter by author sinkog opened on Nov 14, 2026

• Embedded modules are verified against a separate PKI set, not the trust context built by bootstrapPKI (CIC_TRUST_MODE, provenance anchors)

  bug
  CentralInfraCore/CIC_Relay#166 · Filter by author sinkog opened on Nov 14, 2026

• Setx: a failed ProofTrace recording is not reported to the caller (execution success vs proof persisted)

  bug
  CentralInfraCore/CIC_Relay#165 · Filter by author sinkog opened on Nov 14, 2026

• PKI: CRL signature and freshness are not verified, and an unparsable CRL silently disables revocation

  bug
  CentralInfraCore/CIC_Relay#164 · Filter by author sinkog opened on Nov 14, 2026

• cic-flow.actuate: redirects are followed without re-checking egress, the response size is unbounded, and the policy differs from the Rust http-executor

  bug
  CentralInfraCore/CIC_Relay#163 · Filter by author sinkog opened on Nov 14, 2026

• cic-flow capability binding authenticates only the signer certificate, not the module or its manifest; verifyBuildHash is never called in the load path

  bug
  CentralInfraCore/CIC_Relay#162 · Filter by author sinkog opened on Nov 14, 2026

• Audit recorder: signAndCommit is not serialized (lost or unverifiable records under concurrent workflows)

  bug
  CentralInfraCore/CIC_Relay#161 · Filter by author sinkog opened on Nov 14, 2026

• Nightly check failed

  nightly-failure
  CentralInfraCore/CIC_Relay#160 · Filter by author github-actions opened on Nov 11, 2026
  3

• M6: no default CIC_TRUST_MODE, and no silent skip of an unloaded trust store in prod

  security-hardening
  CentralInfraCore/CIC_Relay#159 · Filter by author sinkog opened on Nov 9, 2026

• M5: separate the artifact-signing key from the ProofTrace recorder key

  security-hardening
  CentralInfraCore/CIC_Relay#158 · Filter by author sinkog opened on Nov 9, 2026

• M4: authenticate /v1/schema/compile and validate its inputs

  security-hardening
  CentralInfraCore/CIC_Relay#157 · Filter by author sinkog opened on Nov 9, 2026

• M3: require and cryptographically verify the schema source assertion

  security-hardening
  CentralInfraCore/CIC_Relay#156 · Filter by author sinkog opened on Nov 9, 2026

• M2: fail closed on module loading in prod, and gate the git host functions per module

  security-hardening
  CentralInfraCore/CIC_Relay#155 · Filter by author sinkog opened on Nov 9, 2026

• Keep dependencies current: measure, automate, pin Actions

  CentralInfraCore/CIC_Relay#130 · Filter by author sinkog opened on Nov 9, 2026
  1

• Decide the fate of ci.build@1.0: retire it, or give it a container-aware form

  question
  CentralInfraCore/CIC_Relay#101 · Filter by author sinkog opened on Jul 26, 2026

• Interface proposal: sign+send host capability for WASM provider modules (R1+R2)

  enhancement
  CentralInfraCore/CIC_Relay#89 · Filter by author sinkog opened on Jul 18, 2026
  2

• Dependency Dashboard

  CentralInfraCore/CIC_Relay#26 · Filter by author sinkog opened on Jun 8, 2026